Trezor Safe 5 suspected crypto-theft implant found in device sold by reseller CryptoBilis

What happened

Trezor has received credible reports of a suspected hardware crypto-theft implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia, according to BleepingComputer.

The report came from an Indonesian user who bought a Safe 5 from CryptoBilis through Tokopedia in August 2026. The user opened the device and found an extra circuit board between the main board and the screen, fitted with a cellular module and antenna (BleepingComputer).

Based on unconfirmed information from that customer, the implant appears able to read what is shown on the screen, including the wallet recovery phrase, and send it over a mobile network when the device is plugged in (BleepingComputer, SecurityWeek).

Trezor has not yet received the device to examine it, so whether a malicious implant is present is not confirmed. The device is being shipped to Trezor, and the company has promised updates once it arrives (BleepingComputer).

CryptoBilis is the same retailer implicated in a Ledger implant incident earlier in the month, according to BleepingComputer, which says the two implants appear similar in form and function. Ledger later confirmed that compromise (BleepingComputer).

After the Ledger incident, and before it had any sign it was affected, Trezor stopped sales through CryptoBilis on October 9, 2026. It also said it would restructure and tighten its reseller network globally (BleepingComputer). SecurityWeek describes CryptoBilis as a “former” Trezor reseller (SecurityWeek).

Both outlets report that no stolen funds are known for Trezor devices. BleepingComputer separately notes reported losses among Ledger users, not Trezor users (BleepingComputer, SecurityWeek).

Am I affected?

• Likely in scope: you bought a Trezor device through CryptoBilis from March 2026 onward. Both outlets describe Trezor’s guidance with this same scope (BleepingComputer, SecurityWeek).
• Reported model: the single reported device is a Safe 5. Whether other models sold by CryptoBilis are affected is not confirmed.
• Other sales channels: no other affected retailers are named in the sources.
• Weighing the device: Trezor says weighing a device is not a reliable way to tell whether it has been tampered with (BleepingComputer).

What to do now

1. If you have not yet set up a Trezor device bought via CryptoBilis from March 2026 onward, do not set it up or use it (BleepingComputer).
2. If you already use such a device, move your funds to a newly created wallet with a new recovery phrase. BleepingComputer describes this as moving private keys and assets to known safe wallets (BleepingComputer, SecurityWeek).
3. If you have proof of purchase, contact Trezor to request a replacement device or a voucher for a new one (BleepingComputer).
4. Do not rely on weighing the device to rule out tampering (BleepingComputer).
5. Watch for Trezor’s update after it examines the reported device (BleepingComputer).

Sources

• BleepingComputer: Trezor warns of suspected crypto-theft implant in hardware wallet
• SecurityWeek: In Other News: Trezor Implant, LLMJacking Bills Hit $1M, SAP Flaws Weaponized Within Days